PT-2012-1824

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services version 4.0 Description A CRLF injection issue in autologin.jsp allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter. Recommendations For CiscoWor...

CVE-2011-4237: Improper Control of Generation of Code

CRLF injection vulnerability in autologin.jsp in Cisco CiscoWorks Common Services 4.0, as used in Cisco Prime LAN Management Solution and other products, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter, aka Bug ID CSCtu186...

CiscoWorks Common Services HTTP Response Splitting

The version of CiscoWorks Common Services on the remote host has an HTTP response splitting vulnerability. Common Services is a framework included with several Cisco products. Input to the 'URL' parameter of Autologin.jsp is not properly sanitized. A remote attacker could exploit this by tricking...

Multiple Cisco Products brstart sm_read_string_length Remote Code Execution

Binary data ciscousmlmsbof.nbin...

Cisco Security Advisory: CiscoWorks Common Services Arbitrary Command Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: CiscoWorks Common Services Arbitrary Command Execution Vulnerability Advisory ID: cisco-sa-20111019-cs Revision 1.0 For Public Release 2011 October 19 16:00 UTC GMT...

Cisco CiscoWorks Common Services code execution

It's possible to execute code with LocalSystem privileges...

CVE-2011-2042

The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018...

Design/Logic Flaw

The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018...

CVE-2011-2042

The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018...

CVE-2011-2042

The CVE-2011-2042 entry affects CiscoWorks Common Services 3.x and 4.x (before 4.1) in the Sybase SQL Anywhere database component. Affected component exposes potentially sensitive information (engine name and database port) via an unspecified request to UDP port 2638. Root cause/technical specifi...

CVE-2011-2042: Exposure of Sensitive Information to an Unauthorized Actor

The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018...

PT-2011-3563

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services versions 3.x through 4.0 Description The issue allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638. Recommendations...

Code injection

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

CVE-2011-3310

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

CVE-2011-3310: Improper Control of Generation of Code

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

CVE-2011-3310

CVE-2011-3310 affects CiscoWorks Common Services for Microsoft Windows (pre-4.1). The Home Page component allows an authenticated remote attacker to execute arbitrary commands via a crafted URL, with system administrator privileges on the affected host. The vulnerability impacts multiple CiscoWor...

CVE-2011-3310

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

PT-2011-4384

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services versions prior to 4.1 Description The issue allows remote authenticated users to execute arbitrary commands via a crafted URL. This affects various Cisco products that utilize CiscoWorks Common Services, including...

CiscoWorks Common Services Arbitrary Command Execution Vulnerability

CiscoWorks Common Services for Microsoft Windows contains a vulnerability that could allow an authenticated, remote attacker to execute arbitrary commands on the affected system with the privileges of a system administrator. Cisco has released software updates that address this vulnerability. The...

Cisco Releases Two Security Advisories

Cisco has released two security advisories to address vulnerabilities affecting CiscoWorks Common Services and Cisco Show and Share. These vulnerabilities may allow an attacker to execute arbitrary code or bypass security restrictions. US-CERT encourages users and administrators to review Cisco...